feat: support env-var source for embedding provider api_key

[ericfitz]

Closes #81.

Summary

Adds an optional api_key_env field to vector.embedder naming an environment variable to source the provider API key from, so the secret no longer needs to live in plaintext in config.json. Follow-up to the #78 review discussion.

"embedder": {
  "provider": "openai",
  "model": "text-embedding-3-small",
  "api_key_env": "OPENAI_API_KEY"
}

Behavior

• The variable is resolved at config-load time inside load_vector_config(); the value lands in the existing EmbedderConfig.api_key field, so create_embedder and the vector runtime are untouched.
• When the named variable is set to a non-blank value, it takes precedence over plaintext api_key.
• Named variable unset/blank with a plaintext api_key present → falls back to the plaintext key, with a warning.
• Named variable unset/blank with no usable fallback → clear warning naming the variable, vector tools disabled — matching the loader's existing never-raise, warn-and-disable contract. This applies to openai-compatible too: naming a variable signals intent to authenticate, so we don't silently proceed unauthenticated.
• Existing plaintext api_key configs work unchanged (pinned by a regression test).
• The resolved key value is never logged.

Acceptance criteria from #81

• Embedder config accepts an env var as the API key source (api_key_env)
• Env var takes precedence over the plaintext api_key
• Clear error at startup when the named variable is unset and no fallback key is configured (warn + disable, consistent with all other vector config errors)
• VECTOR_SEARCH.md provider setup docs recommend the env-var path
• Existing plaintext api_key configs keep working unchanged

Testing

12 new unit tests in tests/unit/vector/test_config.py covering every resolution branch (env-only, precedence, fallback, no-fallback for both hosted providers, blank-is-unset, invalid api_key_env types, plaintext back-compat). Full unit suite: 588 passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PCya964sBj74JUSC7WXVqj